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1 Abstract of the Disclosure 

2 

3 The invention provides for hardware processing of ACLs and thus hardware 

4 enforcement of access control. A sequence of access control specifiers from an ACL are 

5 recorded in a CAM, and information from the packet header is used to attempt to match 

6 selected source and destination IP addresses or subnets, ports, and protocols, against all 

7 the ACL specifiers at once. Successful matches are input to a priority selector, which se- 

8 lects the match with the highest priority (that is, the match that is first in the sequence of 

9 access control specifiers). The specified result of the selected match is used to permit or 
10 deny access for the packet without need for software processing, preferably at a rate com- 

l 11 parable to wirespeed. The CAM includes an ordered sequence of entries, each of which 

'12 has an array of ternary- elements for matching "0", "1", or any value, and each of which 

13 generates a match signal. The ACL entered for recording in the CAM can be optimized 

. 14 to reduce the number of separate entries in the CAM, such as by combining entries which .. 

ras are each special cases of a. more general access control specifier. A router uicluding the 

16 CAJv4 can also include preprocessing circuits for certain range comparisons which have 

17 been found both to be particularly common and to be otherwise inefficiently represented 

18 by the ternary nature of the CAM, such as comparisons of the port number against knovm 

19 special cases such as "greater than 1023" or "within the range 6000 to 6500". 
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